ExternalAuth confusing

Sun Apr 7 23:05:49 EDT 2013

Thank you everyone. I have already archived my first milestone upon your help
with Shibboleth. Thanks again.

But with leaning deeply, unknown questions show me continually. Below
information shows me session information after I just logged in with
ExternalAuth:

/Miscellaneous
Session Expiration (barring inactivity): 479 minute(s)
Client Address: 10.86.16.175
SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol
Identity Provider: https://idp.csrdu.org/idp/shibboleth
Authentication Time: 2013-04-08T02:25:12.523Z
Authentication Context Class:
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
Authentication Context Decl: (none)

Attributes/

but you can see the attributes are empty. this is the new issue for me. more
details shows below:

*handler.xml*
...
    <ph:LoginHandler xsi:type="ph:ExternalAuthn"
externalAuthnPath="/signin.jsp"  supportsForcedAuthentication="true">

<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>               
    </ph:LoginHandler> 
...
*signin.jsp*
...
<body>
    <form action="secure/authenticate" method="POST">
        Email:<input type="text" name="email" maxlength="100" id="email"
value="" />
            <br />
            pwd:<input type="password" name="password" maxlength="50"
id="password" value=""><br />
            <input  type="submit" value="Commit">
    </form>
</body>
...

*servlet config in web.xml*    <servlet>
        <servlet-name>secureResource</servlet-name>
        <servlet-class>com.auth.test.ExternalAuthServlet</servlet-class>
    </servlet>

    <servlet-mapping>
        <servlet-name>secureResource</servlet-name>
        <url-pattern>/secure/authenticate</url-pattern>
    </servlet-mapping>

*com.auth.test.ExternalAuthServlet.java*

	protected void doPost(HttpServletRequest request, HttpServletResponse
response)
			throws ServletException, IOException {
		String email=request.getParameter("email");
		String pwd=request.getParameter("password");

		boolean f=true;
		 if(f ){

	            request.setAttribute("forceAuthn", true);
	            request.setAttribute("isPassive", true);

	            Subject subj = new Subject();

	          / * Principal principal = new UsernamePrincipal(email);
	            subj.getPrincipals().add(principal);*/
	            request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);
	            request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY,
"dominic");
	            request.setAttribute(LoginHandler.SUBJECT_KEY, subj);
	            request.setAttribute("authnMethod",
"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport");
	            request.setAttribute("relyingParty",
"https://sp.csrdu.org/shibboleth");
	            AuthenticationEngine.returnToAuthenticationEngine(request,
response);
	    } else {
	            request.setAttribute("loginFailed", "true"); //
	            request.getRequestDispatcher("/signin.jsp").forward(request,
response);
	    }
	}
Here I want return some information to SP from method doPost such as email.
somthing I did as following:
*attribute-resolver.xml*
    <resolver:AttributeDefinition id="transientId"
xsi:type="ad:TransientId">
        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
    </resolver:AttributeDefinition>
  /  <resolver:AttributeDefinition xsi:type="PrincipalName"
xmlns="urn:mace:shibboleth:2.0:resolver:ad" id="UserEmail" /> /

Added one attribute with UserEmail id.

attribute-filter.xml
   <afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">
        <afp:PolicyRequirementRule xsi:type="basic:ANY"/>

        <afp:AttributeRule attributeID="transientId">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="commonName">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="surname">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        *<afp:AttributeRule attributeID="UserEmail">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>*
    </afp:AttributeFilterPolicy>

but I don't know how to edit attribute-map.xml(SP). I don't know how to
follow the format of name of Attribute. below snippet is existing
attribute-map.xml:

    <Attribute name="urn:mace:dir:attribute-def:eduPersonPrincipalName"
id="eppn">

what convertion  does I must respect and how match the customized attributes
added in IDP?

Thanks.

Dominic

-----
Thanks

Dominic
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/ExternalAuth-confusing-tp7585537p7585925.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.